Russia’s Max app has powerful ‘backdoor’ to spy on users, researchers find

Russia’s rapidly expanding Max “super-app” can secretly screenshot users’ devices and access information stored across its services.

According to new research reported by The Guardian, millions of Russians have installed Max, a messaging and payments platform developed by VKontakte, a social media company with close links to the Russian state.

Researchers led by University of Michigan computer scientist Roya Ensafi found the app can access messages and payments within its mini-app ecosystem, take screenshots without users knowing and impersonate users.

Researchers said it can also inject code into mini-apps, potentially allowing it to be used for cyberattacks.

“What Max provides is the cleverest and also the scariest tactic by authoritarian governments” to surveil citizens, Ensafi told The Guardian.

The research found Max cannot access separate apps such as Telegram or WhatsApp, although Russia has banned both platforms.

Public-sector workers, university students, teachers and schoolchildren have reportedly faced pressure to use Max for everyday communications and services.

Ensafi described Max as “a blueprint any government can follow” towards greater digital surveillance, warning Russia has rapidly moved its population towards a more state-controlled internet.