Major web security provider flags Russian ‘super app’ MAX as spyware
A domain linked to Russia’s government-backed “super app” MAX has been flagged as spyware by Cloudflare, the internet’s largest provider of hosting and security services, independent news outlet Verstka reported on Thursday.
Cloudflare’s public internet tracker, Cloudflare Radar, now warns users who query the MAX.ru domain that the website is “malicious”, flagging its use of spyware and four additional “security violations” due to unsecure cross-domain requests.
The report comes after concerns last month that MAX is loaded with malware designed to detect whether a device is connected to a Virtual Private Network (VPN), use of which generally indicates an attempt to evade the Kremlin’s strict internet censorship.
MAX’s privacy policy also stipulates that users’ data can be transferred on request to Russia’s Federal Security Service, as well as ministries, tax authorities, and the national bank. Independent researchers have found that MAX collects geolocation data, monitors apps installed on the user’s device, and can even record audio and video.
A similar spyware flag was applied by Cloudflare to Telega, an unofficial Russian Telegram client, earlier in April. As a result, Telega’s authenticity certificate was revoked and the app was removed from Apple’s App Store, rendering it inaccessible to iPhone users.
However, MAX.ru continues to display a valid TLS certificate, which allows devices to establish a secure connection to the domain, and the MAX app remains available to download on both iPhones and Android devices.
The Russian government has been promoting MAX for over a year as an alternative to popular Western social media platforms such as Telegram and WhatsApp, which are both now widely blocked in Russia due to “security concerns”.
Attempts to force several sectors of Russian society to transition to MAX, including school teachers, civil servants, and soldiers fighting in Ukraine, have been met with various levels of success, with some military units reportedly banning the app’s use entirely.
In March, independent Russian news outlet Faridaily reported that civil servants in Moscow were opting to buy new phones and SIM cards to install MAX, rather than risk the app spying on their personal data.
