The bot uses bogus YouTube pages designed to trick victims into installing what they believe is a codec needed to play a video. Trend Micro advanced threats researcher Joey Costoya says:
A few days ago, these pages started to include a short JavaScript code which enables the Koobface gang to directly monitor page hits.
The hourly tracking allows hackers to "correlate the user activity based on time of day and Koobface infection count."