Over the past 18 months, tens of millions of Russians have been compelled to install a new mobile application called Max, a violet-blue icon promoted by state and cultural figures as a patriotic alternative to popular messaging apps such as Telegram and WhatsApp. Developed by VKontakte, a Russian social media company closely linked to the government, Max quickly became Russia’s most-used messaging platform by summer 2026. Reports indicate that Russian President Vladimir Putin holds an indirect stake in the app.
Max functions as a “super-app,” integrating multiple services into a single platform. It hosts a range of “mini-apps” that provide essential services including banking, messaging, and access to government functions. While the concept of a super-app is not new—China’s WeChat is the best-known example—Max differs in that it has rapidly supplanted a previously freer internet environment in Russia within just a few years.
New research led by Roya Ensafi, an associate professor of computer science at the University of Michigan, reveals extensive surveillance capabilities embedded within Max. The app offers a “backdoor” into all its mini-apps on users’ devices, enabling functions such as taking screenshots covertly, accessing stored information across mini-apps, reading messages and payment data, and impersonating users without their knowledge. Ensafi’s team also uncovered the ability to inject code into these mini-apps, raising concerns that the app could be used as a tool for cyberattacks.
Ensafi characterized Max’s capabilities as among the most advanced digital surveillance tactics employed by authoritarian governments. Unlike China’s WeChat, which evolved alongside decades of internet controls, Max was forcibly introduced to a population with a largely unrestricted internet in previous years. She warned that Max’s blueprint could serve as a model for other states, including Iran, Kazakhstan, and India, seeking to enhance digital authoritarianism.
Though Max cannot infiltrate secure apps such as Telegram and WhatsApp when they are installed, these services have been banned in Russia, effectively raising Max’s prominence. Various sectors in Russia—including public officials, educators, university students, and even schoolchildren—have faced pressure to shift communications onto Max. For instance, a Moscow schoolteacher reported that after a directive from city authorities, all school communication with parents and students was mandated to occur via Max. A student in St. Petersburg described being required to use Max to generate QR codes for campus access.
Despite its growing ubiquity, Max’s adoption among Russia’s political elite appears largely symbolic. Some Kremlin insiders revealed they purchased separate phones solely to use Max, continuing to rely on Telegram and Signal on their primary devices. Additionally, Max has yet to replace Telegram as a major news source; media outlets and public figures continue to use Telegram’s public channels extensively, whereas Max’s equivalents remain underdeveloped.
Users contacted expressed mixed feelings about Max. While many noted its user interface and functions resemble Telegram, concerns about pervasive surveillance were widespread. A Moscow consultant described using Max as “never quite knowing who else might be watching,” adding that while the app is visually appealing, its underlying presence felt unsettling.
Researchers and privacy experts suggest that Russia’s rapid imposition of Max represents a sharp acceleration in digital state control. Unlike China’s 35-year progression to comprehensive internet censorship, Russia has achieved sweeping restrictions and a controlled online ecosystem in less than a decade. Ensafi concluded that this development signals a growing global trend of authoritarian governments aggressively altering the landscape of private communication.
Requests for comment from Max and VKontakte remained unanswered.