University of Michigan Researchers Find Russia's Mandatory 'Max' App Can Screenshot and Impersonate Users Without Consent

A team of computer scientists says Russia's government-linked "super-app" Max has the technical ability to spy on the tens of millions of citizens who now have no real choice but to use it.

The app, built by Russian social media company VKontakte, bundles messaging, banking, payments and government services into one platform. Russian President Vladimir Putin reportedly holds an indirect stake in Max, according to The Guardian, which broke the research findings alongside AOL and other outlets.

What the researchers actually found

Researchers from the University of Michigan, along with collaborators in Canada and India, published a paper titled "Don't Trust the Super-App: A Case Study of Russia's Max" this month. They downloaded the Russian version of the app and examined how it interacts with its "mini-apps" — the smaller programs for banking, messaging and government ID that run inside Max.

According to their analysis, Max has privileged access that lets it screenshot device content, read and alter mini-app data, control login authorization, and inject its own code into those mini-apps. Roya Ensafi, an associate professor of computer science at the University of Michigan who worked on the study, called it "the cleverest and also the scariest tactic by authoritarian governments" to surveil citizens, and said Max is "a blueprint any government can follow."

The ability to inject code, Ensafi said, could theoretically let the Russian government impersonate users without their knowledge or even launch cyberattacks through the platform.

The important caveat

This is a demonstration of technical capability, not proof the Kremlin has used every one of these tools against specific people. Ukrainian outlet ukrmedia.news, citing the same paper, was explicit that the study "demonstrates Max's technical capabilities rather than proving that Russian intelligence services have already used each of them against specific users."

A government having the keys to a backdoor is a serious problem on its own. It doesn't require proof of a specific break-in to be alarming, but readers deserve to know the difference between "this app can do X" and "the state has done X to person Y." No source here documents a confirmed case of Max being used to target an individual dissident or journalist.

Researchers also found one real limit: Max cannot directly reach into separately installed apps like Telegram or WhatsApp and read their messages, according to the study. The catch is that Russia has restricted or effectively banned both of those apps anyway, according to ukrmedia.news, pushing users toward Max by default rather than by genuine preference.

How Max became unavoidable

Max launched in March 2025 and became a mandatory pre-installed app on new phones and tablets sold in Russia starting September 1, 2025, per reporting referencing the app's rollout timeline. By this past summer it had become the country's most-used messaging app, according to The Guardian.

The integration didn't stop with phones. Russian Education Minister Sergey Kravtsov said in March 2026 that all Russian schools — more than 20 million pupils and teachers — had switched their digital communications to Max, according to ukrmedia.news. A Moscow schoolteacher told The Guardian that staff were simply informed: "from now on, everything is on Max," covering homework, parent chats and school communication. "There isn't really an option to say no," the teacher said.

Romanian outlet Informat.ro, drawing on the same reporting, noted something noteworthy: members of the Russian elite reportedly continue using Telegram and Signal for their own communications, sometimes keeping Max only on a secondary phone. If accurate, that suggests the people closest to power aren't necessarily trusting the app they're requiring everyone else to use.

Why this matters beyond Russia

The researchers frame Max as a preview of where other governments could go. Ensafi pointed to Iran, Kazakhstan and India as countries that could attempt similar architecture. The comparison every source reaches for is China's WeChat, the world's best-known super-app. As The Guardian points out, WeChat evolved over decades alongside China's broader internet controls, while Max was imposed rapidly on a population that until recently had comparatively open internet access.

No independent regulator or court has weighed in on the findings, and the Kremlin has not issued a public response to the study cited in this reporting. Outside pressure from foreign governments, tech companies, or Russian users themselves could potentially check a platform that its own government has made close to mandatory for banking, schooling and communication in one of the world's largest countries.