You got lied to by an advertisement.
The lie worked, too.
That’s how these advertisements work.
How common scams and phishing works, too.
They manipulate you.
They use scary words to make you think this: YOU NEED TO ACT!
If you read anything using the scary words “hacker” or “virus” or “dark web”, assume whatever you’re reading is either entertainment, or an advertisement, until proven otherwise.
Somewhat amusingly, the app they’re probably lying about here — the app they’re advertising — doesn’t even solve the problem that the advertiser lied about here. But the app they’re usually lying about — the app they’re advertising — is probably a “coffee shop” VPN app, an app which will badly solves a problem you don’t have and a problem that hasn’t existed for a decade or so, but badly solves it in a way that allows your personally-identified network activity metadata to be available to advertisers.
As for your question, you very likely don’t have malware. (And a website cannot scan your iPhone.) iPhone has robust built-in security, which makes exploiting your iPhone very rather difficult, and the exploit tools involved are very expensive.
It’s much easier to exploit us, ourselves, with lies and fears or such that causes us want to do things that the advertisers want, and not our devices.
For another example of these lies and these fears, see the various discussions of the “pervert” sexploitation spam that’s being mass-mailed.