What does the hypervisor’s management console logs look like? Do you see any unauthorized or authorized logins from there? In the past I experienced the same problem and freaked out but it turned out I logged in to the VM directly from the hypervisor itself. Regardless here are a few scenarios you might find helpful to track the root of that particular login.

1.  Automated Processes or Scripts: Some automated processes or background tasks might spawn additional TTYs for monitoring or logging purposes. Check for any scripts or daemons that may be running with elevated permissions and creating new TTY sessions.
2.  Misconfigured VM Settings: Sometimes, the VM might have configurations that allow for additional console access, either through misconfigured SSH settings or VM management tools. Ensure that console access is restricted in your hypervisor (like VMware, VirtualBox, or KVM) settings.
3.  Virtual Console Access (Hypervisor): Certain hypervisors provide direct console access, which can spawn additional TTY sessions that appear as if they’re logged into the system. Make sure there is no unauthorized access to the VM’s management interface, as this could allow users to access the virtual console.
4.  Exploit or Unauthorized Access: While uncommon, it is possible that someone has gained unauthorized access. Check your system’s auth.log or secure.log files to look for any unusual login attempts, especially if you’re running SSH or have exposed the VM in any network environment.
5.  Check for Root Kits or Intrusions: Run checks with tools like chkrootkit or rkhunter to ensure there are no rootkits or signs of compromise. Unauthorized logins through tty2 might indicate a potential compromise if the VM is accessible over a network.

Steps to Take

•   Audit Logs: Look through /var/log/wtmp, /var/log/btmp, and /var/log/auth.log for unusual login patterns or repeated attempts to access tty2.
•   Disable Unused TTYs: If this is a concern, consider disabling unnecessary TTYs (such as tty2) in /etc/inittab or /etc/systemd/system/getty.target.wants/.
•   Monitor Network Activity: Use netstat or similar tools to observe any unexpected connections or services that might indicate unauthorized access.
•   Check Hypervisor Access Control: Make sure only authorized personnel can access the VM console through the hypervisor.