Consensus-based optimization for closed-box adversarial attacks and a connection to evolution strategies