How are malicious forks resolved?
It's valid but it's a miner writing wrong data, e.g. changing a transaction address to his own or changing a 3 btc transaction to 30 (while the wallet holds 50). The hashes are correct but the miner is using his position as miner to benefit himself or others

Miners can't change that data in a transaction because that data is secured by the transaction-author's digital signature. Any change in the data will cause a signature check to fail.
Nobody cares about other people's balances, no one ever needs to know another person's balance. Bitcoin keeps track of coins not balances. In this case a coin means an unspent transaction output (UTXO). These UTXOs can only be spent by someone who knows the secret number (private-key) that can be used in a mathematical proof of right to spend.