It's not foolproof, but querying the AuthSession looks promising.
Unfortunately, there doesn't appear to be an easy way to find the AuthSession records that correspond to the current SessionID - How can I find the AuthSession that corresponds with the current Session Id?
However, an impersonator will get AuthSession SessionType of SubstituteUser.
A session created when one user logs in via another user. For example, if an administrator logs in as another user, a SubstituteUser session is created. Source
They will also lack
LoginGeoId field values. The former is particularly interesting, as it shows they never really "logged in".
As a very rudimentary check from Apex:
List<AuthSession> authSession = [Select Id from AuthSession where UsersId = :UserInfo.getUserId() and SessionType = 'SubstituteUser'];
Boolean hasLoggedInUser = !authSession.isEmpty();
Of course, this won't handle cases where the actual user is also logged in at the same time. You could do some additional checks to see if there are other active sessions for the same
Alternatively, on the client side you could check for the presence of a
RSID cookie. If this exists then the current session is using the login as functionality.
Unfortunately you can't directly check for the presence of this cookie in Apex as it doesn't have the
apex_ prefix. Maybe write a new Apex accessible cookie client side if
RSID is detected.