I'd like to suggest a middle ground between the "get evidence then act" and the "stay back" answers: where I am, universities and research institutes have an ombudsperson for scientific integrity, and we even have a national Ombuds Committee for scientific integrity.
You can contact the ombudsperson (local or national) about concerns you have about scientific integrity/misconduct and they deal with this in a strictly confidential manner.
Now, while the ombuds system primarily aims at mediation in what is called questionable research practice or remediable misconduct, i.e. lighter cases of misconduct whose effects can be "healed", they can initiate an investigation into the so far only alleged case of serious misconduct (FAQ #5). And even if they'd have to conclude that they cannot (yet) initiate such an investigation based only on what you tell them, your case would be on record, and if more people file similar complaints, at some point there will be sufficient indication for the university to properly investigate the case.
This procedure will be safer for you than trying yourself to find confederates or trying to obtain proper evidence. Also, I'd suspect that the evidence you can get will likely stay thin in the sense that it likely won't be of a quality that can stand in a court case* (since we're talking serious scientific misconduct, this most likely would go to court: the professor has too much to lose to take a plea). In contrast, an investigation by the university has a much better chance to turn up the quality of evidence that is needed here.
I recommend you get away from that group ASAP
In order to save your scientific integrity. As sad as it may be, not only you but science as a whole will likely profit more from you having a career as an active scientist rather than from you becoming a martyr for science.
I may add from personal experience of a milder nature (no falsification, only bad science): colleagues from other institutes/groups did notice both the lack of quality and me not being happy with that. Later on, I was approached about collaboration by someone who explicitly said that they asked me because of the integrity I showed in handling the "bad science situation".
This is a time bomb. If (when!) this is discovered, your career is likely to be seriously affected - whether you actually managed to keep your integrity or not, and even if you have been the one on whose report the investigation started.
I think it is advisable to make extra sure that there is a complete track record of everything you've done, proving there has been no misconduct in your research.
It may be illegal to take copies of your work data home. But it may be possible to deposit copies with the IT department (assuming your supervisor does not have access there); I'd also think about encrypting and signing these backups.
Being able to say that the scientific ombudsoffice has a record of you filing a complaint about scientific misconduct may be another piece to saving what can be saved of your career.
*Consider: assume you had an email openly asking you to falsify data. The moment you openly act on this, your professor would fire or at least suspend you (regardless of whether your complaint is perfectly valid or whether there is a complaint by a vindictive student, the professor would have a perfect case for suspending on the basis that evidently the mutual trust in the employer-employee and professor-student relationships is destroyed). With that, you'd immediately lose access to your university email box. So either you'd find yourself without the "proof", or you'd have to forward it beforehand or print it out. But there's nothing really tamper-proof in such a forwarded email or printout. The hypothetical vindictive student could have fabricated such documents. With a bit more technical knowledge they could even place a file into their email system that looks at first glance as if it were sent by the professor.
Now, a university investigating serious misconduct by one of their employees (the professor), has far more powerful options. E.g. their IT department may be able to show that such an email was actually sent from the professor's account.