- Security researchers found Russia’s MAX app can monitor VPN users
- MAX rejects allegations, saying data is used to ensure high-quality service
- Experts urge removing the app from any device where a VPN is used
A user on Russian security forum Habr has claimed that Russia’s state-backed messaging service, MAX, can monitor VPN users, claiming it turns “the national messenger into a state spyware tool.”
The user published details that they say show the app “contains a spy module.” After being contacted by TechRadar, technical experts at RKS Global — a digital rights organization focused on Russia — said they were able to “fully confirm” the findings following an independent analysis of the app’s latest version.
RKS Global told TechRadar: “MAX can determine that the user is using a VPN, identify the IP address of the VPN server, see the user’s ISP, and detect which restrictions or blocks the user is bypassing.”
Article continues below
The app is developed by VK — the Russian provider behind Mail.ru email and VKontakte social media services — and is integrated with government services. It was first launched in March 2025 and, since September, must be pre-installed on every new smartphone and tablet sold in Russia.
The press team at MAX was quick to reject tracking allegations, claiming the “technical solutions used are aimed at ensuring high-quality service operation — primarily calls and notifications.” The company added that “they have no bearing on personal data or the use of other services, including VPN.”
Russian VPN provider, Paper VPN, offered a more cautious perspective. In a post on X, the team points out that while MAX indeed connects to foreign servers, there are “no indications that this data is being collected specifically for analytics on bypassing blocks.”
TechRadar has approached MAX for comment.
How MAX reportedly tracks VPN users — and the potential risks
According to the technical analysis confirmed by RKS Global, every time a user opens the MAX app, a hidden module named HOST_REACHABILITY collects and sends details about their network environment to VK servers in Russia.
Under Russian law, VK must store and share this information with law enforcement upon request.
The transmitted data reportedly includes whether the user is connected to a VPN, which websites are accessible or blocked on their network, their real IP address, and their ISP. Crucially, users cannot disable this monitoring.
The analysis also found evidence that the module can be controlled remotely. This, RKS Global explains, indicates that targeted activation is possible. Additionally, the app’s traffic appears to be deliberately obscured to make these checks more difficult to detect.
RKS Global warned that this level of tracking could lead to the de-anonymization of VPN connections — a particularly severe risk for users in Russia.
While VPNs themselves aren’t strictly illegal in Russia, their usage is being increasingly criminalized. In July 2025, the Russian Parliament approved a law to punish online searches for so-called ‘extremist’ content and established the use of a VPN to access banned materials as an aggravating legal factor.
Paper VPN, however, noted that the Kremlin already has the ability to monitor VPN usage through other services. Still, the provider echoed concerns about the broader privacy risks of using the app, stating simply that “MAX is not a secure and confidential messenger.”
These latest findings follow a separate technical study from last August, which concluded that MAX possesses “enormous surveillance potential.
How to stay safe
Security researchers at RKS Global are urging anyone using MAX on a device with an active VPN connection to remove the application entirely.
If deleting the app is out of the question, they suggest configuring a VPN at the router level rather than directly on the device. If that is not an option, users should consistently disable their VPN before opening MAX.
There are also some workarounds suitable for more advanced users, including blocking the app’s network traffic via a custom DNS or firewall. On Android, users have the option to install MAX within a separate, isolated workspace to restrict its access to the device’s broader network state.
RKS Global says that ultimately, removing the software is “the only reliable mitigation” and warned that other VK-developed apps may include similar tracking functionality.
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!
https://cdn.mos.cms.futurecdn.net/fXc5c2Q4cUsGEc7bh9VDj4-2560-80.jpg
Source link
chiara.castro@futurenet.com (Chiara Castro)
