Loading story…
InterSecLab’s nine-week assessment of VK’s state-mandated Max Android messenger, version 26.12.0 build 6664, alleges that messages are not protected by end-to-end encryption and can be accessed by VK servers. The researchers said the app’s advertised “secret chats” implement message-deletion timers rather than encrypted conversations.
The report further alleges that VK can enable account-specific functions remotely—including VPN detection, enhanced logging, voice transcription, and network probing—without an app update or user notification. It also identified collection of contact and network data, including unhashed address-book uploads, public-IP and VPN checks, and a concealed reporting channel to trace-flow.ru; an installed-applications component was present but not initialized. The findings have not been independently validated, and the assessment did not document surveillance against any identified individual.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
InterSecLab published its analysis alleging that Max lacks end-to-end encryption, permits VK servers to access message content, and supports server-controlled, account-specific activation of functions including VPN detection, logging, transcription, and network probing. The report also identified the VK-associated domain trace-flow.ru as a secondary reporting channel, while stating it had not documented use of the capabilities against a specific person.
InterSecLab conducted a nine-week technical assessment of Max Android version 26.12.0 build 6664 from March through May 2026, combining pre-encryption traffic capture with static code analysis.
VK's Max messaging application was described as becoming mandatory in Russia beginning in September 2025.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourceinterseclab.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian authorities escalated restrictions on **WhatsApp** and **Telegram**, using network-level controls to disrupt access and steer users toward the Kremlin-promoted *MAX* messaging app. WhatsApp said Russia attempted to fully block the service, warning that isolating more than **100 million** users from “private and secure communication” would reduce safety. Reporting indicated Roskomnadzor removed `whatsapp.com` and `web.whatsapp.com` from Russia’s **National Domain Name System**, effectively breaking domestic DNS resolution so the service becomes largely reachable only via **VPNs** or non-domestic resolvers; digital rights monitors also reported other major services being removed from the national domain registry. Telegram also faced deliberate degradation: Roskomnadzor confirmed it “slowed down” the app, citing noncompliance with Russian law, amid widespread user-reported disruptions across multiple regions. State media reported Moscow courts opened multiple cases against Telegram in early 2026 for allegedly failing to remove content authorities label “extremist” or pornographic, with reported fines exceeding **$820,000**. Kremlin spokesperson **Dmitry Peskov** publicly tied restoration of access to compliance with Russian legislation, while Telegram founder **Pavel Durov** characterized the measures as authoritarian and aimed at forcing adoption of *MAX*, which he described as built for surveillance and censorship; Russia has a history of attempting to block Telegram, including a 2018 ban later lifted in 2020.
Jun 29, 2026
An academic study of 281 popular free Android VPN apps on Google Play found widespread privacy and security failures affecting apps with more than 2.4 billion installs. Researchers from the University of Michigan, the University of New Mexico, and IIT Delhi used the **MVPNalyzer** framework to identify traffic escaping VPN tunnels, plaintext transmission of sensitive data, weak or missing encryption, and extensive contact with advertising and tracking services. The study reported 61 apps with unencrypted data flows, 29 with traffic leakage issues, and 246 that communicated with ad or tracking URLs. The most severe finding affected five apps that downloaded VPN configuration files without encryption, creating a path for an attacker on the same network to hijack the tunnel and redirect users to attacker-controlled VPN servers. Researchers also found weak OpenVPN configuration practices in 107 of 108 apps containing configuration files and said many apps showed poor resistance to censorship or VPN detection. Presented at **NDSS 2026**, the research argued that Google Play trust signals, including safety labels and the VPN "Verified" badge, do not reliably reflect the actual security of Android VPN apps.
Jul 15, 2026
The Dutch intelligence and military security services (**AIVD** and **MIVD**) warned of a **large-scale Russian cyber campaign** targeting individual **Signal** and **WhatsApp** accounts—particularly those of government officials, journalists, and military personnel—by persuading victims to disclose **security verification codes** and **PINs**. The activity does **not** involve breaking end-to-end encryption or exploiting a technical vulnerability in the apps; instead, it abuses legitimate account and security workflows. One commonly observed tactic is impersonation of a *Signal Support* chatbot to solicit verification information, enabling account takeover and access to messages and group chats. The agencies also reported abuse of the apps’ **“linked devices”** functionality, where attackers attempt to attach an additional device to a victim’s account to mirror messages in real time. AIVD/MIVD assessed that the campaign has already produced victims, including within the Dutch government, and that attackers likely accessed sensitive information as a result. Separate reporting about a fake *Red Alert* Android app used to spy on Israeli users describes a different mobile-malware operation (SMS lure, sideloaded trojanized app, extensive permissions, and data exfiltration) and is not part of the Signal/WhatsApp account-takeover campaign.
Aug 27, 2026