Back Mezha

Cloudflare flagged max.ru as spyware linked to Russian messenger MAX

Mezha • April 30, 2026

Security researchers flagged unusual activity around a messaging related domain, raising questions covert data access and third party transfers. The label hints at potential access to messages, calls, files and location, prompting scrutiny but not naming app store actions yet.

According to the report on the Cloudflare Radar platform Cloudflare Radar .

Cloudflare classified the domain max.ru as spyware linked to the Russian national messenger MAX.

According to the Cloudflare Radar report, four security breaches were recorded, and the domain max.ru, associated with the MAX messenger, was classified as spyware.

The spyware label serves as a signal to security systems covert data collection and transmission, including possible access to messages, calls, files, and geolocation, and the transmission of data to third parties.

Earlier a similar label was applied to the Telega domain, a Telegram client, which was later removed from the App Store.

Typically, App Store and Google Play online stores remove apps with such a reputation, underscoring the seriousness of the designation.

In Russia, there were also reports of an unofficial Telegram client named Telega, which ran on VK’s infrastructure and the state messenger MAX, both fully controlled by the Russian government and used for state digital surveillance.

These cases underscore the need for careful verification of the origin of apps and the level of data access before their use.

Don’t miss other news:

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cloudflare Flags Russian Messenger MAX as Spyware Amid Security Concerns Cloudflare has classified the Russian messaging app MAX, associated with the domain max.ru, as spyware due to its potential for covert data collection and transmission. This designation follows reports of unusual activity and security breaches linked to the app, which is promoted by the Russian government. The MAX messenger, available in 40 countries, is suspected of accessing users' messages, calls, and location data. Previously, a similar label was applied to the alternative Telegram client Telega, which was subsequently removed from app stores. The MAX app, developed by VK, has undergone recent updates, including the addition of features like polls and age verification. The app's spyware label raises significant concerns regarding user privacy and data security. As of now, the app remains available for download on major platforms despite the warnings. 12 sources 73

Extracted Entities

Attack Types (1)

Malware

Companies (1)

Cloudflare flagged max.ru as spyware linked to Russian messenger MAX

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Countries (1)

Domains (1)

MITRE ATT&CK (2)

Platforms (3)