Non-malicious VPN software can be used by malicious actors to route packets through servers they control.