The last time I went through the Palantir hiring process, the effort on their end was almost exclusively on technical and cultural fit interviews. My references told me they had not been contacted.

Calibrating your threat model against this attack is unlikely to give you any alpha in 2026. Hiring at tech companies and government is much less deliberate than your mental model supposes.

The current extent of background checks is an API call to Checkr. This is simply to control hiring costs.

As a heuristic, speculated information to build a threat model is unlikely to yield a helpful framework.