A security analyst reviewing authentication logs notices that a user account successfully logged in from an office in Chicago at 9:02 AM and then logged in again from an IP address geolocated in Singapore at 9:14 AM the same day. Both sessions authenticated successfully with the correct password. Which indicator of malicious activity does this BEST represent?