Red Hot Cyber
Cybersecurity, Cybercrime News and Vulnerability Analysis
Li Auto crossovers have begun turning into useless machines after remote theft of user accounts in Russia. In the vehicles the control panels shut down, the air‑conditioning stops working and some drivers cannot even start the engine. This new wave of attacks was discussed by Autonews, citing victims and the brand’s official distributor Sinomach Auto.
Hackers have targeted Li Auto’s master accounts, which serve as the primary digital keys for the car. Through the account it is possible to manage locks, engine start, climate system and other functions. After taking control of the account, the cyber‑criminals alter the owner’s data and demand a ransom to restore access. At least 20 victim cases have been confirmed, but the actual number could be much higher.
This new wave of attacks differs from those of summer 2025. Previously, hackers intercepted Chinese phone numbers linked to the cars through forged documents and access‑recovery procedures. Now accounts with active, paid eSender phone numbers have also been hit.
The exact method of compromise has not yet been determined. The co‑founder of the Lixiang user club, Aleksandr Rasskazov, is considering several hypotheses, including password cracking, credential theft and sharing access codes with third‑party services. Some owners independently provide login and password to companies that install apps, modify firmware and configure vehicle systems.
The consequences have already appeared during real trips. One Li Auto L7 owner, on October 28, experienced a complete shutdown of the electronic control panel. After rebooting, the car required a new activation via QR code, and the same car disappeared from the app. Another driver could not use the Bluetooth key and started the crossover only with the physical key. After ten minutes, the criminal demanded a ransom for the car’s recovery.
These cases show how modern cars depend on external authentication services. Previously, car hacking had already demonstrated the danger of compromising cloud systems and digital keys. However, in the case of Li Auto, there is still no confirmation that hackers have gained direct access to onboard software or learned to intercept control of a moving car.
Sinomach Auto has confirmed the issue and, together with Li Auto, is developing a procedure to verify legitimate owners and safely restore master accounts. The company is also preparing the transition from association with Chinese phone numbers to email authentication. For Li Auto 2026 models, such a mechanism is already planned. The rollout timeline for other cars is not yet known.
Until the new protection mechanisms are active, owners are advised to change their eSender password, verify the phone‑number registration and not share confirmation codes with strangers. In case of loss of access, it is necessary to document the hacking signs, contact Li Auto support and the police. Paying the ransom does not guarantee the restoration of car control to the owner, and current recovery procedures do not ensure a quick solution to the problem.
