How are malicious forks resolved? I understand that forks are resolved by opting in for the eventual longest chain, preferring the chain with the longest POW. But everything I read on this suggests it's just random chance or that the next block is really &quot;alone&quot; on some nodes due to delays in propagating, so &quot;tough luck&quot;.
But let's imagine the scenario where a miner changes the last block with incorrect information for his own benefit, creating block A which should be rejected by the network. Another miner creates block B with the correct data.
We now have a fork, with block A and B being at the end of the chain.
The next miner needs to choose one of the blocks, hopefully not validating the bad intentions of the first miner. How does this gets resolved, how does block A get proven wrong?
It's valid but it's a miner writing wrong data, e.g. changing a transaction address to his own or changing a 3 btc transaction to 30 (while the wallet holds 50). The hashes are correct but the miner is using his position as miner to benefit himself or others

Miners can't change that data in a transaction because that data is secured by the transaction-author's digital signature. Any change in the data will cause a signature check to fail.
Nobody cares about other people's balances, no one ever needs to know another person's balance. Bitcoin keeps track of coins not balances. In this case a coin means an unspent transaction output (UTXO). These UTXOs can only be spent by someone who knows the secret number (private-key) that can be used in a mathematical proof of right to spend.