Suspected credential compromise on finance workstation