Russian super-app Max embeds device surveillance tools

Russia has pushed tens of millions of people to install a new “super-app” called Max over the past 18 months, according to an investigation by The Guardian. The app—a violet-blue button for messaging and payments—has been promoted as a patriotic alternative to Telegram and WhatsApp, with celebrities enlisted to market it. The Guardian reports that Max became the most-used messaging app in Russia over the summer.

Max is produced by VKontakte, which the Guardian describes as closely connected to the Russian state, and the paper reports that President Vladimir Putin owns an indirect stake. The app bundles messaging, payments and “mini-apps” for day-to-day services, including access to government functions. The Guardian frames it as a late, rapid attempt to build something like China’s WeChat—except imposed on a population that previously had comparatively open access to global platforms.

The reporting’s central claim is technical. The Guardian says forensic research found Max contains surveillance capabilities that function as a “backdoor” into the mini-app ecosystem on a user’s device. The investigation cites Roya Ensafi, an associate professor at the University of Michigan, whose team downloaded the Russian version of Max and concluded it can take screenshots without the user’s knowledge, access information stored inside its mini-apps, and impersonate users. The Guardian also reports that Max can inject code into mini-apps, creating a pathway for cyber operations that would be difficult for ordinary users to detect.

Max does not need to “break” end-to-end encrypted rivals if those rivals are not allowed to operate. The Guardian reports that Russia has banned Telegram and WhatsApp, and that many people in or around state institutions have been effectively forced onto Max: officials, public-sector employees, university students, teachers and even schoolchildren. One Moscow schoolteacher told the Guardian that staff were ordered by city authorities to move all communications—parent chats and homework included—onto Max, with no real option to refuse.

That combination—platform bans on alternatives, institutional coercion for adoption, and a single app that blends personal life with state services—turns convenience into compliance. For users, the cost of resisting is social and professional isolation; for institutions, the cost of not enforcing adoption is friction with superiors and incompatible workflows. The Guardian quotes Ensafi warning that the model is replicable, naming Iran, Kazakhstan and India as governments that could seek similar capabilities.

The Guardian’s investigation describes a system that is easiest to understand in mundane terms: the app that pays your bills and delivers your child’s homework is the same app that can quietly capture your screen. The technical feature is the screenshot; the policy feature is that refusing to install it can mean refusing to function.