> If the network does stall, either from network outages or malicious behavior, the nodes go into recovery mode, waiting for recover messages. Individual nodes will send these messages to signal to the network that it should either continue processing the last known block proposal or to propose a new block. When a quorum of votes is received for either one of these messages, the system will revert to normal operation. In the case of malicious behavior, the protocol may select a new leader. In the case of network outage, the current block will continue to be processed or a new block might be proposed.
For other blockchains, the answer will depend on their implementation. It's likely you're gonna have to understand the underlying protocol before you can understand the potential threats, and consequently how the protocol addresses those threats. So for other blockchains, your best bet to understand what happens in the case of malicious nodes, is to understand the whitepaper describing the protocol.
> The VRF takes a secret key and a value and produces a pseudorandom output, with a proof that anyone can use to verify the result. The VRF functions similar to a lottery and is used to choose leaders to propose a block and committee members to vote on a block. This VRF output, when executed for an account, is used to sample from a binomial distribution to emulate a call for every Algo in a user’s account. The more Algos in an account, the better chance the account has of winning – it’s as if every Algo in an account gets its own lottery. This method ensures that a user does not gain any advantage by creating multiple accounts.
https://www.algorand.com/Algorand%20Protocol.pdf
The search term you're looking for is "decentralized leader election", searching for that on Google or Google Scholar gives you bunch of results ranging from random musings to academic papers.