What scenario is more likely: 1. While in Japan, or during the planning of the trip to Japan, the persons visited websites that indicated a preference towards

What scenario is more likely: 1. While in Japan, or during the planning of the trip to Japan, the persons visited websites that indicated a preference towards visiting Japan, and sometime later an ad network connected the cookie with their past behavior and served an ad for a flight, or 2. Someone has created a hitherto unknown stealth malware designed to circumvent the "microphone on" notification on smartphones and exfiltrate audio from a user's device, deployed the infrastructure to store and process the audio, and then done everything already needed in scenario 1 to serve ads for a flight. Any moderately-skilled network engineer or security professional would be able to instantly tell if a device was sending audio to a remote server if told to look. And highly-skilled people are actually looking.