A security analyst reviews authentication logs and discovers that a user account successfully authenticated from New York at 09:15 AM EST and then authenticated again from Tokyo at 09:45 AM EST on the same day. Both login attempts were successful, and no VPN connections were detected. Which indicator of malicious activity is MOST likely present?