Jens Asbjørn Bøgen
Russia has spent this year pushing its citizens onto one homegrown messenger.
Max, built by tech company VK, has been mandatory on every smartphone, tablet, computer and smart TV sold in Russia since September 1, 2025. Roskomnadzor threw WhatsApp out of the country’s domain-name system on February 11 and throttled Telegram to a near-block two days earlier.
A new technical audit says the app is more than a state-approved brand. Digital-security lab InterSecLab spent nine weeks probing Max and concluded that VK can quietly change how the app spies on any single user, without shipping an update or touching the interface.
“What Max does is set on VK’s servers, per account, without an app update,” the InterSecLab report says.
Network probing, VPN detection, voice-message transcription, elevated logging and the list of outside services allowed to receive a user’s identity can all be flipped on for one account at a time.
No end-to-end encryption
Max carries no end-to-end encryption at all, and its “secret chats” only auto-delete messages instead of encrypting them, the researchers write. They captured plaintext traffic inside the app before it reached the encrypted transport layer.
Every launch of the app sends VK a report containing the user’s public IP address, mobile carrier, VPN status and internet reachability, according to the study. A separate concealed channel forwards further data to a domain on VK’s network.
Address book and phone-number exposure
At registration, Max uploads the user’s entire address book to VK in cleartext, including the numbers of non-users, InterSecLab writes. The company had previously stated the numbers were hashed.
A phone-number lookup returns the target’s account ID, display name and creation date, with no notification to the person searched and no rate limit on the queries.
“Within 1.2 seconds VK’s servers began streaming that person’s real-time online status to the account that asked, and kept streaming it for over fifteen minutes,” the report says.
VPN blocks and pre-selected channels
The app detects a device-level VPN and shows a full-screen instruction to disable it before any message can be sent, though a router-level VPN slips past the check.
New accounts arrive pre-populated with 25 recommended channels that InterSecLab describes as leaning toward state media and pro-government figures. VK’s chief executive is the son of a senior Kremlin aide.
InterSecLab analyzed version 26.12.0, build 6664 of the Android app between March and May 2026.
