August 18 on GitHub appeared A detailed analysis of the APK file for the Russian messaging app Max (or “Max”). An analysis conducted by enthusiasts revealed extensive collection of personal data, background audio recording, and access to a wide range of system resources. The findings are shocking: the messaging app doesn't just send messages—it also actively monitors the device, collecting data about the user, their surroundings, and even the software installed on the device.
Doberman.media took a detailed look at report GitHub.
What is Max Messenger?
Max is a messaging, calling, and file-sharing app developed in Russia. It is available on Android (via Google Play, RuStore, and AppGallery), iOS, and desktop platforms. Its features include high-quality calls, animated stickers, the ability to send files up to 4 GB, chatbots, and mini-apps.
The app package is ru.oneme.app. However, according to the analysis, this facade conceals a powerful tool for telemetry and surveillance. Previously, users had noticed that The app activates the camera every 5–10 minutes, even in the background, and now an APK analysis has confirmed an even deeper level of access.
The app is marketed as a “government messenger,” and there are suspicions of ties to the FSB: its servers are located in Russia, which gives intelligence agencies legal access to the data. Experts from GitHub analyzed the code and found that a significant portion of it is obfuscated—encrypted to make analysis more difficult.
Code Obfuscation: Why Is Analysis Difficult?
One of the key issues is obfuscation. The com.my.tracker.obfuscated module contains classes with nonsensical names like e0, c1, y2, and methods such as a(), b(). This is a standard practice to protect against reverse engineering, but in the context of a messaging app, it raises suspicions: the true extent of the surveillance remains hidden. Without complete deobfuscation, it is impossible to understand exactly how the data is processed and where it is sent. However, even the visible part of the code shows alarming signs.
Data Collected: From Age to List of Apps
The MyTracker module is responsible for collecting telemetry data. It records:
— User-defined events: Advertising interactions, purchases (including product IDs, prices, and currencies), invitations, app launches, level progression, logins, sign-ups, and time spent in the app.
— Personal Information: Age, gender, custom IDs, email, phone numbers, social media IDs (ICQ, OK.ru, VK), interface language, and arbitrary parameters.
— Attribution Data: Transition sources (links), system events.
In addition, the app accesses:
- Location (GPS, Wi-Fi, networks).
- Contacts (read/write).
- Accounts on the device.
- Files, images, videos.
- Camera and microphone (background audio recording).
- Bluetooth, biometrics.
- List of installed apps.
The analysis showed that the app can record audio and video in the background, capture the screen, and sync contacts with external servers. This goes beyond the scope of a typical messaging app: the data includes IP addresses, device specifications, and even the time spent in mini-apps.
| Data Category | Examples |
|---|---|
| Personal | Age, gender, email, phone number, social media ID |
| System-level | Location, IP address, device model, list of apps |
| Events | Logins, purchases, time, ads |
| Access | Camera, microphone, contacts, files |
Permissions and Components: Full Control Over the Device
The AndroidManifest.xml file in APK MAX reveals the requested permissions—the list is extensive and includes:
- Internet access, Wi-Fi, Bluetooth.
- Reading/writing contacts and accounts.
- Camera, microphone, geolocation.
- Autostart on boot, notifications, background services.
- Screen capture (mediaProjection), installing packages.
Components such as MainActivity, LinkInterceptorActivity (link interception), ContactsSyncService, and background services (CallServiceImpl) allow the app to run in the background, synchronize data, and even display content on top of other windows. ForegroundServiceType includes microphone|camera|location|mediaPlayback|dataSync, which means continuous monitoring with minimal notifications.
System Lock-in and Network Manipulation
The app gains persistence through autorun (BootCompletedReceiver), background services, and contact synchronization. There are no direct signs of root exploits, but the permissions allow it to request the installation of other APKs and capture the screen.
Regarding network aspects: There are no VPN permissions for comprehensive sniffing, but LinkInterceptorActivity intercepts links, and OkHttpClient can modify requests. References to VPNs in WebRTC are intended for connection adaptation, not for surveillance.
Additionally: Collects input from chat rooms (lastInput), but without system-level keylogging.
Max Messenger Poses a Risk to Privacy
The analysis confirms: Max isn't just a messaging app—it's a data hub. It records everything—from personal data to background activity—with obfuscation that hides the details. Under Russian law, this could mean that the FSB has access to this information. Users are advised to avoid installing the app or to use alternatives with end-to-end encryption, such as Signal or Telegram (with some caveats).
Experts emphasize that without encryption, the risk of data leaks is high. If you're already using Max, check its permissions and monitor the device's activity. This is a reminder of the importance of privacy in the digital world.
0 comments
Enter your email — we’ll send you a one-time code. No passwords or accounts.
Code sent to
If the email doesn't appear in your inbox within a few minutes, check your spam, junk, or promotions folder, as some email services may mistakenly place automated messages there