Hackers are hiding malicious code inside website themes on Vietnamese streaming sites, and they are using that code to target iPhone users with spyware built to steal crypto wallet seeds.
That is the report from September 1, 2026. Poisoned themes. Spyware. Crypto theft. You do not need to be a day trader to get hit. You just need to land on the wrong streaming site with a wallet on the same phone.
A seed phrase is the whole wallet
A crypto wallet seed is a short list of words that rebuilds the wallet from scratch. Usually 12 or 24 words. If a thief gets that list, they do not need your phone, your passcode, or your face. They take the funds. That is why this kind of attack skips the lock screen and goes straight for the words.
It pisses me off because regular people get sold on being their own bank, and then nobody tells them the vault is a scrap of paper and a habit. One poisoned page can empty that vault.
How a poisoned website theme gets you
A theme is the look of a site. Headers, buttons, the layout you stop noticing. When attackers poison it, the malicious code can load with the page. You think you are watching a stream. The site is doing extra work in the background.
The report says this was hidden inside Vietnamese streaming sites. Those places draw a crowd. Free matches, free shows, no official app required. They also tend to be run by people you cannot see and would not trust with your house keys.
Your iPhone is not an invisibility cloak
A lot of folks still treat an iPhone like a force field. Apple does lock the platform down tighter than most. That helps. It does not mean a browser page cannot be used against you.
This campaign is aimed at iPhone users on purpose. Spyware plus seed theft, delivered through a site theme. No sideloaded app. No install prompt. You opened a browser and tapped a link.
What you should do if you hold crypto on a phone
Treat the phone that holds a wallet like cash in your pocket, not like a TV remote. You would not count bills out loud in a crowded lot. Do not type a seed into a website. Do not paste it. Do not take a photo of it and leave it in the camera roll.
- Never enter a seed phrase on a website, in a pop-up, or in a chat. A real wallet will not ask for that on a streaming site.
- Keep unofficial streaming sites off the same phone you use for crypto.
- Store seed words on paper, offline. Not in Notes. Not in email. Not in cloud screenshots.
- Update iOS when the update is there. Old software is a gift to thieves.
- If a page asks you to verify, sync, or restore a wallet, close it. That is the con.
You cannot fix the whole web. You can stop handing it the keys. And if you do not hold any crypto, take the same lesson for banking and email. A free stream on a random site is a lousy place to log into anything that matters.
Primary Source: https://cybersecuritynews.com/malicious-website-themes/