Study Reveals Hidden Monitoring Capabilities in Russia's Max App
Researchers found that the state-run Max platform can secretly capture screens and alter data within its internal ecosystem, raising serious privacy concerns as it becomes mandatory for schools and services.
A new study reveals that Max, the Russian government’s primary messaging application, possesses technical features that allow it to monitor user activity without their knowledge. Researchers from universities in the US, Canada, and India discovered that the platform can capture screen content, read and modify local data, and even inject code into smaller programs running inside the app.
While the findings do not prove that intelligence services have already used these tools against specific individuals, they highlight a significant shift in digital oversight. As the Kremlin pushes Max to replace other communication services, the ability to control and observe users within this single ecosystem presents a major trade-off for anyone relying on it for daily life.
Hidden tools enable deep observation
The investigation, published in September, focused on how Max interacts with mini-apps, which are small utilities that operate within the main platform. The researchers found that Max has privileged access to these components, allowing it to take screenshots of the interface and monitor network traffic. This capability means the platform can see exactly what a user is doing within the app, even if they believe their actions are private.
More concerning is the ability to alter the user’s authorization context, which could theoretically allow the platform to impersonate a user. Professor Roya Ensafi from the University of Michigan described this as a dangerous model of control, noting that combining messaging, payments, and government services in one place creates a centralized point of vulnerability that is hard to escape.
Mandatory adoption expands surveillance reach
The risk is amplified by recent government mandates. Starting in September 2025, manufacturers were required to pre-install Max on all new smartphones and tablets sold in Russia. This forced adoption ensures that the platform is present on nearly every device, making it the default channel for communication and digital identity verification.
In 2026, the integration went even further into public life. The Ministry of Education announced that all schools, serving over 20 million students and teachers, have switched their digital communication to Max. This move effectively places a large portion of the population under the platform’s technical umbrella, increasing the scope for potential surveillance as noted by critics and reported by GN technics/mobile (en-US).
Limitations exist but pressure remains
It is important to note that the study did not find evidence that Max can directly read messages from separately installed apps like Telegram or WhatsApp. The identified capabilities are confined to the Max ecosystem and its internal mini-apps. However, this technical limitation is less relevant in practice because the Russian authorities have been actively restricting access to these alternative platforms.
As other messaging services face blocking or slowdowns, users are pushed toward Max by necessity rather than choice. This creates a situation where the platform’s monitoring capabilities are not just a risk, but a structural feature of daily digital life in Russia. The trade-off is clear: access to essential services comes at the cost of significant privacy and transparency.
