A security analyst reviews authentication logs and discovers that a user account successfully logged in from New York at 09:00 AM EST and then from Tokyo at 09:45 AM EST on the same day. The account shows no other anomalies, and the user is currently on vacation. Which indicator of malicious activity is MOST likely present?