A security analyst reviewing authentication logs notices that a user account shows login activity from New York at 9:00 AM EST and from Singapore at 9:15 AM EST on the same day. The account has not logged out between these sessions. Which indicator of malicious activity is MOST likely present?