Nah, I'm pretty sure its your VPN. Hooliganism is not that uncommon on the internet ya know XD. I mean you have heard of that virus back in the early 2000s that changed everybody's programs on their desktop to a link to amishpeoplemeet.com right? It got published in a ton of books as an early example of mostly benign viruses.
Besides, even ExpressVPN even posted an alert about it on their blog too just a few days ago. Here's the link: