How Russia’s ‘super-app’ Max became a dossier on its users

# What Max is and why it spread Max is a "super-app" developed by VKontakte and rolled out across Russia as a single platform for messaging, payments and government services. Russian authorities promoted it as a patriotic alternative to Telegram and WhatsApp. Public figures and entertainers pushed the app in media, and by the summer it became the country's most-used messaging service.

The rollout happened quickly: over roughly 18 months tens of millions of people installed Max. The app bundles an ecosystem of mini-apps—third-party or in-house modules for banking, messaging, ID checks, and official services—inside a single container.

# What researchers found A University of Michigan team led by Roya Ensafi downloaded the Russian version of Max and examined its internal behavior. Their analysis reconstructed how Max interacts with mini-apps and the host device. Key findings:

• Max can take screenshots of a device, including mini-app content, without user knowledge.
• It can access stored information in mini-apps, including messages and payment records.
• The app can impersonate users inside the mini-app ecosystem.
• It can inject code into mini-apps, which raises the possibility of using the platform as a vector for cyberattacks.

Ensafi described these capabilities as a backdoor into the entire mini-app ecosystem on each user's device. She said the design offers a model other governments could replicate.

# Limits and the role of bans The researchers note an important technical limit: if a user still has third-party encrypted apps such as Telegram or WhatsApp installed, Max cannot break into those apps. The practical problem is political: Russia has banned those alternatives. That makes Max the default platform where the state and state-linked institutions can consolidate communications.

# How people were pushed onto Max The app's spread was not purely organic. Schools, universities and municipal authorities issued directives to move official communications to Max. Examples in the reporting include:

• A Moscow school ordering staff to use Max for parent chats, homework and other school communication.
• A St Petersburg university requiring students to produce a QR code generated through Max to access buildings and dormitories.

Public-sector employees, teachers, students and people working around state institutions faced direct or indirect pressure to install and use the app.

# How elites and everyday users behave Among political and business elites, use of Max often appears ceremonial. Reported practices include installing Max on a second phone while retaining Telegram, Signal or other messaging apps on a main device for day-to-day private exchanges. For many ordinary Russians with ties to state institutions, refusal was not a practical option.

# Comparisons and context Reporters compared Max to WeChat, China's super-app that combines commerce and state control. Max differs in speed and context: WeChat evolved alongside China's broader internet controls, while Max has been imposed on a population that previously enjoyed more open internet access.

The reporting also includes an allegation that Vladimir Putin holds an indirect stake in Max. The account stresses that Max is a product of VKontakte, a company with deep ties to the state.

# What to watch next Max's mini-app architecture and the pressure to adopt the app concentrate user data and control in a single platform. The technical details researchers uncovered point to how a national app can be engineered to capture conversations, transactions and app-level interactions at scale, especially when alternatives are banned or restricted.