Forensic research has revealed that Max, a Russian “super-app” designed for messaging and payments, possesses powerful surveillance capabilities. According to Roya Ensafi, an associate professor of computer science at the University of Michigan, these capabilities create a “backdoor” into the app's entire mini-app ecosystem on users' devices.
Ensafi's team found that Max can reportedly screenshot users’ devices and the content of its mini-apps without their knowledge. It can also access information stored in these mini-apps, including messages and payments, and impersonate users. The research suggests Max could even inject code into mini-apps, potentially allowing the Russian government to launch cyberattacks.
Over the past 18 months, tens of millions of Russians have reportedly been compelled to install Max, which became the country’s most-used messaging app this summer. Many working in or around state institutions, including officials, public-sector employees, university students, teachers, and schoolchildren, have faced pressure to use the platform for communications.
Max is a product of VKontakte, a Russian social media company with reported ties to the Russian state. While authorities have promoted it as a patriotic alternative to apps like Telegram and WhatsApp, concerns about privacy and surveillance are widespread among users.