MAX

Russian Minister Proposes Blocking All SIM Cards Linked to Fraudsters Banned in MAX Messenger

The head of Russia's Ministry of Digital Development, Maksut Shadaev, has suggested extending account bans in the MAX messenger to a broader set of mobile restrictions. Under the proposal, operators would be required to disconnect not only the number used in a fraudulent account but also any other SIM cards belonging to the same individual. The measure would also introduce a cooling-off period preventing the person from registering new numbers after a ban. Officials aim to make it significantly harder for scammers to resume operations following enforcement actions. Key implementation details, including how ownership and involvement in fraud will be verified, remain unspecified in the initial statement. The initiative specifically targets fraud prevention and does not apply to every account suspension in the messenger.

How to Secure Your Gosuslugi Account Against Hacks and Recover Access After Takeover

Russia's Gosuslugi portal now holds far more than basic documents, including tax notifications, child records, data-sharing consents, and access to other government services, making account security critical. The guide stresses using a unique strong password, enabling two-factor authentication with TOTP or biometrics instead of SMS, and regularly reviewing active sessions and connected mobile apps. It details steps to add a trusted contact for recovery, audit consents granted to third parties, and monitor for unauthorized logins or statements. In case of suspicious codes or calls, users must never share verification codes and should immediately check actions in the system, revoke unknown consents, and contact support. If access is lost, recovery options include online password reset with passport data or in-person visits to service centers, followed by credit history checks and self-imposed credit bans via Gosuslugi starting March 2025. The advice also covers protecting the linked phone number and email to prevent SIM swaps and further fraud.

VK Files Lawsuit in EU Court Seeking to Overturn Sanctions Imposed in July

Russian internet company VK has submitted a formal challenge to the European Union's sanctions regime by filing a case with the Court of Justice of the European Union. The company argues that the restrictions placed on VK and its subsidiary Communication Platform LLC are both unjustified and unlawful. The lawsuit, registered under case number T-664/26 on 7 October, directly contests the July sanctions that targeted the developer of the MAX messenger. Earlier restrictions had already led to the removal of multiple VK ecosystem applications from Apple App Store and Google Play, forcing users toward alternative distribution channels such as RuStore, Huawei AppGallery, Samsung Galaxy Store and Xiaomi GetApps. While installed Android applications continue to function and receive updates, iOS users face disrupted push notifications after the apps were delisted. The legal action itself does not automatically restore app availability in the affected stores.

Russia Plans to Expand MAX Messenger with Unified Ticket Purchases Across All Transport Types

The Russian Ministry of Transport is developing new features for the MAX messenger to allow users to plan routes and purchase tickets for urban transport, trains, airplanes, and sea or river vessels within a single application. First Deputy Minister Konstantin Pashkov stated that the platform already supports verification of eligibility for discounted travel and handling of travel documents. Future plans include greater reliance on biometric identification, enabling passengers to complete bookings digitally and board using camera recognition without showing QR codes or physical documents. The initiative forms part of a gradual transition, with no immediate plans to phase out existing payment methods. New regulations effective from September 1 permit confirmation of social benefits through MAX and the use of biometric services where carriers have the required equipment. No specific timeline for full implementation of integrated ticketing has been provided.

F6 and MAX Neutralize Over 2,550 External Phishing and Scam Resources in Two-Month Operation

F6 and the MAX messenger have jointly blocked more than 2,550 malicious external websites used for phishing, scams, and other forms of online fraud. The effort relied on the F6 Digital Risk Protection platform, which continuously scans for fake authentication pages and fraudulent resources targeting users. Monitoring took place during July and August 2026, after which experts from both organizations arranged for the sites to be taken down. The action focused exclusively on external resources and did not involve any malicious content hosted inside the MAX messenger itself. F6 Digital Risk Protection head Stanislav Goncharov noted that regular takedowns can reduce attacker activity over time, yet users must still verify website addresses manually before entering credentials or payment data.

MAX Desktop Client Tested for VPN Detection on Windows, No Tracking Signs Found

A Habra user named Slava_B conducted an experiment on September 8, 2026, to determine whether the MAX desktop client on Windows could detect or route traffic through a VPN configured at the router level. The setup used a Keenetic router that directed Russian resources directly while sending other connections via an OpenConnect tunnel to a European VPS, with no VPN client or virtual adapter present in Windows itself. Monitoring tools including Process Monitor, Wireshark, TCPView, and tcpdump revealed that MAX.exe and MAX-service.exe processes communicate locally and connect to MAX/ONEME infrastructure along with AppTracer services. The application repeatedly accessed MachineGuid, computer name, proxy settings, device IDs, and microphone/camera information, though these reads may support diagnostics and anti-fraud functions. No connections appeared on the VPN interface, and the client did not attempt to reach IP-checking services, Telegram, or WhatsApp. The researcher noted that TLS traffic was not decrypted, so actual transmission of identifiers could not be confirmed, and results apply only to this router-based configuration.

Separating Identity and Delivery Channels for Compliant Telegram Mini App Authentication

A developer shared a detailed case study on building legally compliant user identification for Telegram Mini Apps targeting Russian audiences. Instead of relying solely on Telegram initData verification, the project routes authentication through established Russian providers including VK ID, Yandex ID and MAX. Identity is handled separately from message delivery channels, with telegram_id used only for notifications after account creation. The implementation employs OAuth 2.1 with PKCE for VK, OAuth 2.0 for Yandex, and deep links for MAX while enforcing short-lived cryptographic state values and HttpOnly session cookies. Additional measures include consent checkboxes required by Russian law and polling-based result delivery to support browser, WebView and extension environments. The same architecture was reused for Home Assistant smart-home login, demonstrating reusable separation of identity and channel concerns.

Compliant Telegram Mini App Authentication via Russian ID Providers in My Anti-Social Network Project

The project 'My Anti-Social Network' demonstrates a production-grade approach to Telegram Mini App authorization that meets Russian identification requirements by separating user identity from delivery channels. Instead of relying solely on Telegram initData verification, the system routes authentication through VK ID, Yandex ID, and MAX using OAuth 2.0 / 2.1 flows with PKCE. Sensitive tokens never reach the browser; the client receives only short-lived one-time codes exchanged for HttpOnly session cookies. The architecture supports multiple front-ends including PWA, browser extensions, and Home Assistant integration while maintaining cryptographic protections around state parameters and code verifiers. The solution was implemented for an aggregator delivering personalized news feeds through Telegram, MAX, VK bots, and voice assistants.

MAX Messenger to Open Source Code and Launch Developer Program for Alternative Clients

The Russian messenger MAX is preparing to open its platform to third-party developers by launching a dedicated developer program and providing API access. Approved participants will receive the official client's source code, design system, technical documentation, and access tokens to integrate with the platform infrastructure. The initiative targets IT companies from Russia and friendly countries that demonstrate experience with large-scale projects and adherence to strict security standards. All selected developers must implement secure development practices, robust encryption mechanisms, and undergo code audits to protect user data. The program supplies ready-made user registration and anti-fraud tools, while alternative clients remain bound by API usage terms focused on security compliance. Applications will be accepted via the official developer portal, although exact launch dates have not yet been disclosed.

VK and MAX Apps Removed from Google Play Store Amid EU Sanctions on Russian Company

VK and its national messenger MAX have been removed from the Google Play Store following the European Union's decision to add the parent company to its sanctions list. The company confirmed that the apps are no longer available for new downloads or updates through Google, but existing installations continue to function normally with full access to messaging, calls, events, and push notifications. Users can obtain updates and new installations through alternative Android stores including RuStore, Huawei AppGallery, Samsung Galaxy Store, and Xiaomi GetApps, or receive in-app update prompts when new versions become available. The removal comes shortly after similar apps such as Dzen and VK Video disappeared from the Apple App Store last month. Although the exact reasons were not disclosed in VK's statement, the sanctions were triggered specifically by the development of the MAX messenger as a national platform. This development highlights how regulatory actions are reshaping app distribution channels for Russian digital services, positioning RuStore as a primary rather than backup marketplace.

Kremlin Spokesperson Peskov Labels EU Sanctions Against MAX Messenger as Manifestation of Repressive Policy

Dmitry Peskov, the press secretary to the Russian president, has strongly condemned the European Union's decision to impose sanctions on the Russian messenger MAX, describing the move as absolutely absurd and a clear demonstration of the repressive character of European sanctions policy. The EU added the parent company VK and its subsidiary LLC Communication Platform, the developer and operator of MAX, to its sanctions list due to their connection with Russia's national messenger. This action follows the removal of the VK and MAX applications from the Apple App Store in June, although already installed versions continue to function without the ability to receive updates through the store. VK has stated that the sanctions have not impacted the messenger's operations and that MAX along with other services remain fully available to users in normal mode. The situation raises questions about whether further barriers will emerge around MAX beyond the current sanctions listings and App Store restrictions, with political rhetoric currently outweighing any significant technical consequences.

EU Adds Russian Tech Giant VK to Sanctions List Over Development of National Messenger MAX

The European Union has included VK in its sanctions regime, targeting the parent company of Russia’s largest social media platforms including VKontakte and Odnoklassniki. The move was triggered by VK’s ownership of the developer behind the national messenger application MAX, which Russian authorities have been promoting as a domestic digital platform. According to the Council of the EU, VK serves as the parent structure for LLC Communication Platform, the entity directly responsible for creating and operating MAX. The sanctions decision was formally published on 13 July in the Official Journal of the European Union, marking the first time Brussels has directly sanctioned a major Russian IT holding in connection with a consumer messaging service. While the exact operational and commercial consequences for VK, its subsidiaries, and international partners remain unspecified in the official notice, the action extends EU restrictive measures beyond traditional sectors such as banking, energy, and manufacturing into the Russian technology industry. VK’s press service stated that the sanctions do not affect the functioning of VK or MAX and that all applications and services remain available to users without disruption.