That is not how this supposedly works. The Oxylabs people (according to the author) put software out there (like Apps, or Installers whatever) and those are infected. That's why it's hard to proof this, first link those gnarly apps to oxylabs, next link oxylabs to NordVPN.
This is how it could be done:
Rent Oxylabs Residential IP's (600$ minimum commitment, according to [0]).
Check out IPs, stop using them, hope they get rotated to NordVPN, where you'd have to monitor the ips used.
At Oxylabs pricing the only possible conclusion if a match was found would be that the services are intertwined.
[0]: https://oxylabs.io/pricing/residential-proxy-pool