A security analyst receives an alert that a user's account authenticated successfully from New York at 9:00 AM EST and then authenticated again from Tokyo at 9:45 AM EST on the same day. The user is a finance employee who typically works from the New York office. Which indicator of malicious activity is MOST likely being observed?