Cloudflare retracts spyware labels for two Russian messaging apps

Cloudflare has reversed its decision to label two Russian messaging apps as spyware. The move follows a review of its earlier classifications, which had led to one app’s removal from the App Store. Both developers have strongly denied the allegations, insisting their software is secure. In early April, Cloudflare marked Telega, a Russian Telegram client, as spyware. This designation triggered Apple to remove the app from its store after Telega lost its TLS certificate. The developers responded by filing a complaint with Russia’s Federal Antimonopoly Service (FAS) against Apple, arguing the removal was unjustified.

Cloudflare later admitted the classification was based on a misunderstanding of web analytics headers—not an examination of the app’s actual code. Telega’s team maintained that the software contained no hidden functions and posed no risk to user data.

On May 1, Cloudflare also retracted the spyware label from Max Messenger, another Russian messaging platform. The company behind Max Messenger stated that its app undergoes regular security audits and participates in bug bounty programmes. They confirmed that all user data remains fully protected. The reversal means neither Telega nor Max Messenger is now classified as spyware by Cloudflare. Telega’s complaint against Apple remains under review by Russian authorities. Both apps continue to operate, with their developers emphasising transparency and security in their software.