Russia’s State-Backed MAX App May Detect VPN Usage, Researchers Claim
Published
Key Takeaways
- MAX app VPN detection claims: Researchers say app may detect VPN use, identify server IPs, user ISP, and bypassed restrictions.
- Government-linked messaging platform: MAX, developed by VK, launched in 2025 and is mandatory pre-installed on new devices.
- Company denies surveillance allegations: MAX says detected mechanisms only support service quality like calls and notifications, not tracking users.
Security researchers say that Russia’s state-backed messaging platform MAX may be capable of detecting when users connect through a virtual private network (VPN). The claim has sparked debate among privacy experts, while the app’s developers have denied any wrongdoing.
The concerns emerged after a user on the Russian security forum Habr alleged that the application includes a “spy module” capable of monitoring VPN activity. The user suggested that the feature effectively turns the national messaging platform into a state surveillance tool.
Researchers Say MAX Can Detect VPN Use
Following the forum post, analysts from RKS Global, a digital rights organization focusing on Russia, conducted an independent analysis of the latest version of the MAX app. According to the group, their findings confirmed the presence of technical capabilities that can identify VPN connections.
Researchers say the app may be able to determine whether a user is connected through a VPN and identify the IP address of the VPN server being used. The analysis also suggested the app could detect a user’s internet service provider (ISP) and determine which internet restrictions or blocks the user might be attempting to bypass.
These findings raised concerns among privacy advocates who argue that such capabilities could potentially be used to monitor how users access restricted online content.
App Is Tied to Government Services in Russia
The MAX messaging platform is developed by VK, the Russian technology company behind services such as Mail.ru email and the VKontakte social media platform. The app was introduced in March 2025 and is integrated with several government services.
Since September 2025, MAX has also been required to come pre-installed on all new smartphones and tablets sold in Russia. This requirement significantly expanded the app’s reach across the country.
The mandatory installation has drawn scrutiny from digital rights groups, especially amid claims that the platform may include tools capable of identifying VPN usage.
MAX Denies Tracking Allegations
In response to the claims, the MAX press team rejected the allegations that the app is used to track or monitor users.
According to the company, the technical mechanisms identified by researchers are designed only to maintain service quality. The team said these solutions help ensure stable operation for features such as calls and notifications.
MAX representatives also emphasized that the systems “have no bearing on personal data or the use of other services, including VPN.”
VPN Provider Urges Caution in Interpreting Findings
Meanwhile, the team behind Paper VPN, a Russian VPN provider, offered a more cautious interpretation of the findings. In a post on X, the company noted that while the MAX app does connect to foreign servers, there is no clear indication that this data is specifically being collected to analyze how users bypass internet restrictions.
Despite the differing interpretations, some security experts have advised users to remove the app from devices where VPN services are used, particularly if privacy is a concern.
The situation remains under discussion, and MAX has been approached for additional comment regarding the claims.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular