HackTool.AndroidOS.Arpspoof

This malicious application uses ARP spoofing to intercept traffic within a local network. Root access is required for the application to work. The application uses the iptable class=”most_attacked_countries”. Core functionality related to traffic modification is contained in ELF files.

Geographical distribution of attacks by the HackTool.AndroidOS.Arpspoof family

Geographical distribution of attacks during the period from 08 June 2016 to 08 June 2017

Top 10 countries with most attacked users (% of total attacks)

* Percentage among all unique Kaspersky users worldwide attacked by this malware