A security analyst reviewing authentication logs notices that a sales manager's account successfully logged in from an office in Chicago at 9:02 AM, and then a second successful login for the same account appeared from an IP address geolocated in Singapore at 9:14 AM. Both sessions remained active simultaneously. Which indicator of malicious activity BEST describes what the analyst has observed?