A security researcher has discovered malicious code inside the firmware of four low-budget push-button mobile phones sold through Russian online stores.