A security analyst reviews authentication logs and discovers that a user account successfully authenticated from Tokyo, Japan at 08:15 UTC, and then the same account authenticated from New York, USA at 09:30 UTC the same day. There are no VPN connections associated with either login. Both authentication attempts were successful and used correct credentials. What indicator of malicious activity does this scenario BEST represent?