Around 9 p.m. Pakistan time, a disruption appeared on Geo News transmission that immediately triggered a digital wildfire across X, WhatsApp groups, Telegram channels, and YouTube commentary feeds. The message displayed on screen in Urdu stated: “Certain circles of your army have brought the whole of Pakistan to destruction. Stand up against it.” Within minutes, screenshots spread claiming that Israeli and Indian hackers had hijacked Pakistan’s broadcast infrastructure, while others asserted that this was the work of the Israeli Intelligence Corps SIGINT unit. Some accounts amplified it further, framing it as the opening salvo of a coordinated cyber campaign against Pakistan’s leadership. Before facts could breathe, narratives were already marching.
Simultaneously, another visual began circulating — a Mossad-branded message in English and Persian reading: “Our brothers and sisters in Iran… Share with us the photos and videos you take from the homeland. Let’s fight together for them.” That creative, however, appeared not on the live satellite feed but as a digital advertisement displayed on Geo’s website. The juxtaposition of the transmission override and the Mossad-branded ad created confusion, and confusion is fertile ground for manipulation. It allowed social media to collapse two technically distinct events into one geopolitical accusation.
Let us separate what was observed from what was alleged.
What was observed: a temporary interruption in Geo News broadcast showing anti-army messaging. Geo publicly distanced itself, calling it an unauthorized hack unrelated to its internal editorial operations. Normal programming resumed within minutes. There were also claims of similar disruption affecting ARY News and Tamasha, though evidence remains fragmented and largely screenshot-based rather than independently verified through broadcast archives.
Geo New was Hacked by Israel.
The hacked payload utilized Naskh Script (standard in India/Middle East) instead of Pakistan’s Nastaliq standard.
This proves the message was rendered using foreign digital asset libraries, confirming an external threat actor. pic.twitter.com/G9uNaEUddG
