Russia's MAX super-app poses transnational repression risk

Russia's state-controlled MAX super-app, mandatory on new phones domestically, now registers users in 40+ countries, creating surveillance and coercion risks for diaspora communities.

Russia has introduced MAX, a state-controlled super-app developed by VK that integrates communications, payments, identification, and government services into a single ecosystem modeled on China's WeChat. Required pre-installed on new phones sold in Russia since September 2025 and pushed through administrative pressure on banks, schools, and public agencies, MAX operates within Russia's SORM lawful interception framework, giving FSB and other agencies potential access to user metadata including IP addresses, contact lists, behavioral metrics, and communications patterns. The platform's privacy policy explicitly permits data sharing with state agencies.

While domestic adoption has been slow despite manufactured popularity metrics, MAX's strategic significance lies in its extraterritorial reach. Registration expanded in March 2026 to telecom operators across 40+ countries in Latin America, Asia, Africa, the Middle East, and Eastern Europe. This creates coercive ecosystem dependency for Russian diaspora communities, migrant workers, students, dual nationals, residents of occupied Ukrainian territories, and businesses maintaining Russia-linked operations who need the platform for administrative necessity—maintaining family contact, banking relationships, employment systems, and government services.

The intelligence and transnational repression implications are substantial. MAX's metadata aggregation and identity integration within state-controlled infrastructure enables de-anonymization, social graph mapping, and surveillance of diaspora networks, activists, journalists, and dissidents abroad. Even individuals who never install MAX may become visible through contacts' usage. The platform represents an exportable authoritarian technology model that extends surveillance and information control across borders without traditional malware, creating new vulnerabilities through administrative and social dependency rather than technical exploitation.

Source reporting: https://dfrlab.org/2026/05/21/the-domestic-russian-super-app-that-could-create-cross-border-security-risks