Russian owners of Li Auto vehicles have encountered a new wave of master-account thefts that allow attackers to seize control of the cars through the official mobile application.
After losing access, some vehicles experience disabled infotainment screens and climate control, while others face difficulties starting the engine. Attackers subsequently contact the owners and demand payment, typically between 35,000 and 45,000 rubles, to return the account.
The issue was first detailed by Autonews.ru and has been confirmed by a representative of Sinomach Auto, the official distributor of Li Auto in Russia. Co-founder of the Lixiang owners club Alexander Rasskazov stated that roughly twenty victims are already known, although the true total is likely higher.
The master account governs all remote functions via the branded application. Consequences vary: some owners see their vehicle disappear from the profile entirely, while others lose only selected features. One victim reported being able to start the car with a physical key after the Bluetooth key stopped working.
The precise method used to compromise the accounts is still unknown. Rasskazov noted that even owners who paid for Chinese phone-number services through eSender to maintain account control are now being targeted.
Li Auto and its distributor are currently developing both protective mechanisms and a formal account-recovery process. Plans also include migrating account binding from Chinese phone numbers to email addresses. The new solutions are intended to cover both officially imported vehicles and those brought in through parallel import channels.
