A MitM will create a certificate whose signature will be successfully validated against the certificate of the fake CA in your trust store.
For example, if someone managed to install fake (fraudulent) CA certificate (to which they have the private key) into your trust store, they could use that CA cert's private key to issue a fraudulent certificate for security.stackexchange.com. If they then had an MitM position, they could intercept your request for security.SE, and supply their fraudulent certificate. Your browser would accept it as valid for the StackExchange web site, while in reality everything you send and receive goes through the attacker (who fully controls the traffic both ways and could even be serving you a totally fake site). Everything would look fine from your end because the certificate is trusted by your browser, because you trust the attacker's fake CA which is the issuer of the site's (fraudulent) certificate.
