A network analyst investigating slow performance on a corporate LAN notices that multiple workstations show the same MAC address mapped to the default gateway's IP in their ARP caches, and packet captures reveal traffic destined for the gateway is being relayed through an unexpected internal host before reaching the router. What type of attack is most likely occurring?