A security analyst reviews authentication logs and discovers that a user account from the finance department is currently logged in from two different locations: one session from the corporate office in New York at 2:15 PM EST, and another session from an IP address in Romania at 2:17 PM EST. Both sessions are actively accessing financial records. What type of indicator of malicious activity is MOST clearly demonstrated?