"A Spy in Your Pocket": Russian Messenger Max Tracks Users and Helps Block VPNs

The international research laboratory InterSecLab, in cooperation with the analytical center RKS Global, published the results of its study of the Russian messenger Max.

Since September 2025, Russian authorities have made the Max messenger, developed by VK, mandatory for all smartphones and tablets sold in Russia. Simultaneously, access to independent communication tools was blocked: the Signal messenger was blocked in August 2024, WhatsApp in February 2026, and mass blockings of Telegram began in March 2026.

Today, Max is being forcibly implemented for obtaining government services both in Russia and in the occupied territories of Ukraine — even for enrolling children in school or making doctor's appointments. Consequently, it is gaining popularity among Belarusians as well, for work or communication with relatives in Russia.

Max's interface almost completely copies Telegram, but behind it hides a surveillance tool for Russian special services.

How Experts Broke into Max's "Closed System"

Max's developers tried to maximally protect the application from external analysis. It uses a closed protocol with Russian federal cryptography from an FSB-licensed provider, stores addresses in encrypted form, and immediately terminates operation upon detecting research tools.

To bypass these barriers, researchers conducted their study on Android version 26.12.0 (build 6664) from March to May 2026. They created a special mechanism that captured the content of messages and requests within the program at the moment before encryption — directly in the smartphone's RAM.

No Secret Correspondence in Max: Complete Absence of End-to-End Encryption

Secure messengers use End-to-End Encryption — only the sender and recipient have the key to the correspondence, and servers only see an encrypted set of characters.

Max has no end-to-end encryption at all. All messages are transmitted and stored on VK servers in unencrypted form. Each text message is tagged with flags for server checking for links, voice messages are decrypted on VK servers, and during calls, conversations are passed through a voice analysis module on the phone, which VK can remotely replace from its server.

In Max, You Can Track Everyone — Each Individually

Experts call this per-account controls and consider it the main discovery of the research.

Normally, for a new feature to appear or settings to change in an application, the user downloads an update. In Max, the VK server can remotely enable or disable any features or spy functions (network probing, VPN detection, voice decryption, extended logging) for a single user or group of people without any notifications in the interface.

As a result, two people with the same Max version can use virtually different applications and not even realize it.

Max Smartphone as a Probe for Censors' Needs

Max systematically collects a full report on the network environment: when opened or switched to background mode, it requests the external IP address, identifies the mobile operator, checks for VPN presence, and the availability of a number of resources, including the Russian public services portal.

Moreover, a hidden probing channel (network probing) was found in the application:

1. The VK server sends an encrypted list of internet addresses to the phone.
2. The application independently and silently "pings" each address from the received list from the user's device.
3. The results are sent to the trace-flow.ru server within the VK network. During tests, the channel launched 19 times, and among the addresses was Apple's push notification service, which wasn't even in the application's initial code.

This means that Russian censors are using millions of ordinary people's phones as hidden "scouts" to see in real-time which independent website or VPN service is working for different operators and in different regions, and to block it faster.

Max: VPN Blocking, Tracking by Number, and Address Book Leak

• Upon detecting a VPN on the device, Max immediately stops working and demands that the secure connection be disabled, forcing the user to choose between a censorship circumvention tool and a public services application.
• During registration, Max uploads the entire address book (names and numbers) to VK servers in unencrypted form.
• Any user can request information about another person's phone number, after which VK servers begin broadcasting their online status in real-time for over 15 minutes without notifying the victim.

How to Minimize Risks If Max is Necessary

Experts emphasize that Max should not be used for private or sensitive correspondence. If the application is needed for government services in Russia or communication with relatives, they advise adhering to the following rules:

1. Application Isolation: Install Max in a separate Android work profile or use a separate "clean" smartphone for it.
2. VPN on the Router: Max specifically looks for a VPN on the smartphone. If the VPN is configured on the home router, the application does not see or block it.

• 1
• 0
• 7
• 4
• 4
• 0
• 7
• 0