One App to Track Them All: Inside Russia's Max
Surveillance control · 21.09.2026

Российское государство нашло идеальный способ следить за гражданами: заставить установить одно приложение вместо десяти. Международная команда исследователей из университетов Мичигана, Калгари, Джорджии и Дели разобрала супер-приложение Max на запчасти — результат впечатляет даже по меркам цифрового авторитаризма.

Wait, let me provide the actual English translation below.

The Russian state has found the perfect way to surveil its citizens: force everyone to install one app instead of ten. An international team of researchers from the universities of Michigan, Calgary, Georgia, and Delhi took apart the Max super-app piece by piece — and the results are impressive even by the standards of digital authoritarianism.

Since March 2025, Max, made by the VK group (whose management is under EU sanctions specifically for suppressing free speech), has been pushed onto the market while Roskomnadzor simultaneously strangles Telegram and WhatsApp. The outcome: schools, payments, access to government services — none of it works without Max anymore. A classic move: first cut off the alternatives, then declare the only remaining option "convenient."

Technically, it's elegant and terrifying at the same time. Android isolates every app by default — but a super-app breaks this model, turning itself and all its embedded mini-apps into a single trust zone. Researchers counted five attack vectors: Max can secretly take screenshots, read cookies and session tokens in plain text, inject arbitrary JavaScript code, route traffic through state proxies, and impersonate the user to mini-apps. No system permissions, no warnings, no traces — just quiet and orderly.

Meanwhile, the app itself is armored: it checks for VPNs, SIM cards, geolocation, time zones, refuses to connect from non-Russian IPs, and uses its own GOST TLS encryption instead of international standards. Reverse-engineering this thing from the outside is quite the challenge — and that's no accident.

A special touch for connoisseurs of irony: according to insiders, Russian officials themselves keep using Telegram and Signal, while Max sits on a spare phone. Convenience for the people, apparently, doesn't have to apply to everyone.

The Guardian and the researchers warn of the main risk: merging every aspect of life into one state-controlled app means that blocking an account can instantly cut a person off from school, transport, and finances all at once. The scientists are calling for super-apps to be regulated like browsers — with strict OS-level isolation.

And yes, the trend toward weakening end-to-end encryption isn't exclusive to authoritarian regimes. The UK's Online Safety Act, initiatives in Canada, and talk of chat control in the EU are all heading in the same direction — just using different words, for now.

Source: https://www.heise.de/hintergrund/Digitaler-Totalitarismus-Wie-Russlands-App-Max-zur-Ueberwachungswaffe-wird-11459403.html