A security analyst reviews authentication logs and discovers that a user account successfully authenticated from New York at 09:15 AM EST and then authenticated again from Singapore at 09:45 AM EST on the same day. The user is a marketing manager with no international travel scheduled. Which indicator of malicious activity is MOST clearly demonstrated?